$12.67 Was Swept From a Bitcoin Address After Bots Spent About $4,800

Sweeper bots spent about $4,800 in Bitcoin fees to capture $12.67 from a weak-key address. A separate EIP-7702 dispute shows why wallet permissions, transaction nonces and bidding controls matter to automated traders.

CryptoMEV Bot NewsroomNov 1, 20263 min read

A command-line terminal displaying software logs and warning messages in green text. — Image: Fabo.Hax / Wikimedia Commons (CC BY-SA 4.0)

Automated sweeper bots spent about $4,800 in Bitcoin transaction fees in January 2026 to capture $12.67 from a compromised address, according to Crypto Briefing. The target was a SegWit address whose private key had been derived from the coinbase transaction ID of Bitcoin block 924,982.

Fee rates fell between the two sweeps

Two deposits arrived at the weak-key address. The first was 0.00018209 BTC and the second was 0.00002096 BTC, together totaling 0.00020305 BTC. Both were swept within minutes, leaving the address with a zero balance and no remaining unspent outputs.

Several bots detected the deposits and competed to claim them. They used replace-by-fee, or RBF, which allows a sender to replace an unconfirmed transaction with a version paying a higher fee. Miners generally prefer the higher-paying version, so the replacement tends to win.

Fee rates reached 12.8 sat/vB on the first sweep and 4.80 sat/vB on the second.

Before	After
First sweep: 12.8 sat/vB	Second sweep: 4.80 sat/vB
Earlier of the two deposits	Later of the two deposits

By the end, the bots had collectively spent about $4,800 in fees to net $12.67. Most of those fees went to miners.

Operational checks for wallet and bot operators

Compare the target balance with a firm ceiling for replacement fees.
Confirm that wallet keys are not derived from publicly visible blockchain data.
Track unconfirmed transactions and fee rates when competing for the same deposit.

The research cited by Crypto Briefing put the cost at roughly 380 times the value of the prize. It said repeated collisions on small deposits limit sweeper profitability and described stop-loss logic as a control for capping how much a bot is willing to pay. No identifiable person or entity was tied to the incident, and no bot operator was named.

RBF bidding shifted value to miners

RBF was designed to let users accelerate a stuck transaction when the network is busy. In the reported race, competing bots used the same mechanism as an escalating bid, while miners collected most of the resulting fees.

For automated execution readers, the case illustrates the importance of bid ceilings; our automated trading reference and exchange execution reference cover the relevant implementation areas.

Crypto Briefing also reported similar RBF bidding wars on other weak-key addresses, including cases involving larger sums. The January 2026 incident stood out because of the gap between the reward and the fees paid to secure it.

EIP-7702 put signing permissions in focus

On October 30, 2026, Cardano founder Charles Hoskinson shared a technical analysis that alleged Ethereum's EIP-7702 delegation feature helped an attacker empty a Binance hot wallet, according to Crypto.news. The analysis was posted by CyberSatoshi and described reconstructed bytecode for an alleged Binance sweeper. Hoskinson's accompanying message did not identify a specific protocol flaw or explain which part of the analysis he endorsed.

EIP-7702 allows an externally owned account to delegate execution to code deployed at another address. Delegated code executes in the account's context and can support batching operations and allowing another account to pay transaction fees. Each authorization specifies a chain, delegate address and nonce, together with a cryptographic signature.

The report said the specification does not establish how Binance signing credentials were obtained. It also states that delegation cannot be assigned to an arbitrary account without a valid authorization.

CyberSatoshi claimed the attacker submitted 50 signed authorizations covering consecutive nonces to track Binance 14 while its transaction count changed. Under the rules, multiple consecutive entries can become valid as the nonce advances, and the last valid delegation determines the code address used.

Binance safeguards claim remained an allegation

According to the CyberSatoshi breakdown, the reconstructed contract left exactly 1 ETH in the wallet while sweeping its native balance. The poster argued that this prevented Binance's automated hot-wallet queue from failing because of insufficient gas and raising an alarm.

The analysis also described a custom execution function that allegedly let the compromised wallet call an external vault holding $823 million in USDC. CyberSatoshi characterized the contract as purpose-built for Binance's architecture, while the claims about internal alerts and treasury systems remained the poster's explanation of how the operation worked.

The Ethereum specification does not establish how any Binance signing credentials were obtained.